CVE-2026-98647 bpf: Fix divide-by-zero in btf_struct_walk()
A local attacker with low privileges can cause a kernel crash via divide-by-zero in BPF struct walking when loading specific programs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98647?
CVE-2026-98647 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix divide-by-zero in btf_struct_walk()
When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size.
BTF takes an empty struct, so this in program BTF
/* event could be empty */ struct event { #ifdef HAVE_TIMESTAMP __u64 ts; #endif };
struct batch { int nr; struct event events[]; };
divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a sleepable program.
Oops: divide error: 0000 [#1] SMP KASAN PTI RIP: 0010:btf_struct_walk+0x53f/0x1570 Call Trace: <TASK> btf_struct_access+0x42a/0xcd0 check_ptr_to_btf_access+0x4dc/0x1160 check_mem_access+0x3a45/0x8740 check_load_mem+0x36a/0xd10 do_check_common+0x3ef0/0xb210 bpf_check+0x6d3b/0x8580 bpf_prog_load+0xf7c/0x2720 __sys_bpf+0xa83/0x3690 __x64_sys_bpf+0xc7/0x150 x64_sys_call+0x1f3f/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
Reject a zero-sized element type. The fixed array path in the same function already bails out on the same thing:
btf_struct_walk() ... /* skip empty array */ if (moff == mtrue_end) continue;
msize /= total_nelems;
Which versions are affected by CVE-2026-98647?
How do I fix CVE-2026-98647?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98647 being exploited?
There is no known exploitation of CVE-2026-98647 in the wild and no public exploit code.
Sources
Also known as AZL-109206, BELL-CVE-2026-98647, DEBIAN-CVE-2026-98647, GHSA-p98x-gg62-cxq2, UBUNTU-CVE-2026-98647.